Document the tls_automate_names global option - #570
IslamElsayed wants to merge 3 commits into
Conversation
Added in caddyserver/caddy#8015: names certificates should be managed for without adding a route for them, replacing the empty-site-block workaround.
|
|
||
|
|
||
| ##### `tls_automate_names` | ||
| Manages certificates for the given names without serving them. The names get the same certificate management [Automatic HTTPS](/docs/automatic-https) gives the names in your site blocks, but no route is added, so Caddy does not respond for them. |
There was a problem hiding this comment.
State that this is an explicit request and still enables certificate management when auto_https off or disable_certs is configured. The implementation deliberately behaves like force_automate; describing it only as the same management provided by Automatic HTTPS does not make that precedence clear.
|
|
||
| A name that also has its own site block keeps that site's certificate settings. May be repeated; the names accumulate. | ||
|
|
||
| (Requires Caddy 2.12 or newer.) |
There was a problem hiding this comment.
Remove this version claim until the target release is confirmed.
The version note was a guess from v2.11.4 being the latest release. @francislavoie and @steadytao settled on 2.11.5 rather than 2.12 on caddyserver/caddy#8015, since the option is a low-impact addition and not an API change.
|
Updated the version note from "2.12 or newer" to "2.11.5 or newer" in 30a0dc0, following @francislavoie and @steadytao settling on 2.11.5 for this in caddyserver/caddy#8015 — it was the one thing in here I had flagged as a guess rather than a fact. |
|
Cheers. Just the remaining comments then should be good. |
@steadytao's review: describing the option only as the management Automatic HTTPS provides hid the precedence. Listing a name is an explicit request, so it is still managed when auto_https is off or disable_certs, the same way the tls directive's force_automate forces automation for a site. Verified by adapting both: `auto_https off` and `auto_https disable_certs` each leave the name in the automate loader. caddyserver/caddy#8015 pins the first in tls_automate_names_auto_https_off.caddyfiletest.
|
Both addressed — and apologies for the delay on the first one, I missed your inline comments for four days because I was filtering reviews by date and they predated the window I was looking at. Entirely my fault. Precedence (line 479) — rewritten in 712f690:
I checked both halves rather than just the one I had a test for — adapting Version claim (line 485) — you asked for it removed until the target was confirmed. It has been since, in caddyserver/caddy#8015, so it now reads "2.11.5 or newer" rather than the 2.12 guess. Say the word if you would still rather it came out entirely until the release actually ships. |
Documents the
tls_automate_namesglobal option added in caddyserver/caddy#8015, as @steadytao asked for on that PR.The name is the one @francislavoie settled on there, so this should not need renaming — but if it does move, it is this one entry plus the line in the syntax summary.
One thing I could not determine and would like corrected rather than guessed at: I wrote "(Requires Caddy 2.12 or newer.)" on the basis that v2.11.4 is the latest release, so the next minor would be 2.12. If the option lands in a different version, that line is wrong.
I checked both code samples against a build of the caddy PR rather than writing them from memory:
tls_automate_namesexample adapts tocertificates.automate: ["*.example.com"]with a route only forfoo.example.com*.example.comroute the text warns aboutThe other claims in the entry — that a name with its own site block keeps that site's settings, that the option accumulates when repeated, and that a Caddyfile of only global options is valid with it set — are each covered by an adapt test in the code PR.
Disclosure: I use AI assistance when working on patches. I wrote and checked this entry myself, and verified every example and claim above against a build.